URL
BibTeX DOI
Abstract. Application compartmentalization and privilege separation are our primary weapons against ever-increasing security threats and privacy concerns on connected devices. Despite significant progress, it is still challenging to privilege separate inside an application address space and in multithreaded environments, particularly on resource-constrained and mobile devices. We propose MicroGuards, a lightweight kernel modification and set of security primitives and APIs aimed at flexible and fine-grained in-process memory protection and privilege separation in multithreaded applications. MicroGuards take advantage of hardware support in modern CPUs and are high-level enough to be adaptable to various architectures. This paper focuses on enabling MicroGuards on embedded and mobile devices running Linux kernel and utilizes tagged memory support to achieve good performance. Our evaluation show that MicroGuards add small runtime overhead (less than 3.5%), minimal memory footprint, and are practical to get integrated with existing applications to enable fine-grained privilege separation.
Authors. Zahra Tarkhani and Anil Madhavapeddy
See Also. This publication was part of the Information Flow for Trusted Execution project.
Previous Revisions. There are also earlier revisions of this paper available below. Please cite only the latest version of the paper above where possible.
|
(Older v1) Enabling Lightweight Privilege Separation in Applications with MicroGuards |